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Abstract. Rigorous Verification and Validation (V& V) techniques axe 
essential for high assurance systems. Lately, the performance of some of 
these systems is enhanced by embedded adaptive components in order 
to cope with environmental changes. Although the ability of adapting 
is appealing, it actually poses a problem in terms of V&V. Since uncer- 
tainties induced by environmental changes have a significant impact on 
system behavior, the applicability of conventional V& V techniques is 
limited. In safety-critical applications such as flight control system, the 
mechanisms of change must be observed, diagnosed, accommodated and 
well understood prior to deployment. 

In this paper, we propose a non-convent ional V&V approach suitable for 
online adaptive systems. We apply our approach to an intelligent flight 
control system that employs a particular type of Neural Networks (NN) 
as the adaptive learning paradigm. Presented methodology consists of a 
novelty detection technique and online stability monitoring tools. The 
novelty detection technique is based on Support Vector Data Description 
that detects novel (abnormal) data patterns. The Online Stability Moni- 
toring tools based on Lyapunov’s Stability Theory detect unstable learn- 
ing behavior in neural networks. Cases studies based on a high fidelity 
simulator of NASA’s Intelligent Flight Control System demonstrate a 
successful application of the presented V&V methodology. 


1 Introduction 

The use of biologically inspired soft computing systems (neural network, fuzzy 
logic, AI planners) for online adaptation to provide adequate system function- 
ality in changing environments has revolutionized the operation of realtime au- 
tomation and control applications. In the instance of a safety-critical adaptive 
flight control system, these changes in the environment can be, for example, a 
stuck stabilator, broken aileron and/or rudder, sensor failure, etc. Stability and 



safety are two major concerns for such systems. In recent years, NASA con- 
ducted series of experiments evaluating adaptive computational paradigms for 
providing fault tolerance capabilities in flight control systems following sensor 
and/or actuator failures. Experimental success suggest significant potential for 
developing and deploying such fault tolerant controllers for futuristic airplanes 
[1-4]. 

The non-probabilistic evolving functionality of realtime controllers, through 
judicious online learning, aid the adaptive system (aircraft) to recuperate from 
operational damage (sensor/ actuator failure, changed aircraft dynamics: broken 
aileron or stabilator, etc). This adds an additional degree of complexity and sys- 
tem uncertainty. Since it is practically impossible to estimate and analyze before- 
hand all possible issues relative to adaptive system’s safety and stability, these 
systems require a non-conventional, sophisticated V&V treatment. While adap- 
tive systems in general are considered inherently difficult to V&V, system uncer- 
tainties coupled with other real time constraints make existing traditional V&V 
techniques practically useless for online adaptive systems and implementation of 
a non-conventional V&V technique a challenging task [5,6]. This (in) ability to 
provide a theoretically valid and practically feasible verification and validation 
remains one of the critical factors limiting wider use of neural networks based 
flight controllers [5-7]. 

We propose a non-conventional V&V approach and derive a validation method- 
ology suitable for online adaptive systems. We apply our approach to an adap- 
tive flight control system that employs Neural Networks (NN) as the adaptive 
learning paradigm. Presented V&V methodology consists of an online novelty 
detection technique and online stability monitoring tools. The novelty detection 
technique is based on Support Vector Data Description (SVDD) in order to de- 
tect novel (abnormal) data patterns. As a one-class classifier, the support vector 
data description is able to form a decision boundary around the learned data 
domain with very little or even zero knowledge outside the boundary. The online 
stability monitoring tools based on Laypunov stability theory axe designed to 
detect unstable (unusual) NN behavior. The underlying mathematics of the on- 
line monitoring tools is a rigorous mathematical stability verification technique. 
This technique emphasizes the need for a precise stability definition for adaptive 
systems and reasons about the self-stabilizing properties of the adaptive neural 
network within the control system’s architecture. 


1.1 Paper Overview 

We propose a V&V framework that is suitable for online adaptive systems in 
Section 2 The presented validation approach requires an understanding of two 
complementary novelty detection and stability analysis techniques that axe dis- 
cussed in detail in Sections 3 and Section 4. In Section 5, test cases and simula- 
tion results describing the operational behavior of the online novelty and stability 
analysis are discussed in detail. We conclude the paper with a brief discussion on 
the prospects of the presented V&V approach for other online adaptive systems 
in Section 6. 



2 A V&V Framework 


One of the goals of our V&V and safety assurance approach is to ensure the 
correct diagnosis followed by blocking/permitting of novel (abnormal or unreli- 
able) data from entering the online adaptive component, the neural network. We 
propose to use novelty detectors and safety monitors as online filters [8]. Figure 1 
illustrates the V&V framework. The SVDD data analysis technique is capable of 
detecting anomalies in the neural network’s inputs and outputs. Safety monitors 
disallow the propagation of unsafe controller gains (adjustments) from entering 
the controller. It is evident that such a device must require a wide range of 
system (aircraft) domain- knowledge. Therefore, we seek to define a control error 
adjustment and detection technique suitable for alerting from anomalous, unsta- 
ble, and eventually unsafe aircraft behavior if the outputs from neural network 
adaptation were to enter the controller. 
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Fig. 1 . Adaptive Flight Control System’s V&V Framework. 


Another key step of the validation framework is the runtime stability mon- 
itor. Its goal is to determine whether, under given flight conditions, the neural 






network converges, i.e., if its state transition trajectories lead to a stationary 
state. The online monitor is complemented by mathematical stability proofs [9] 
that can define its engagement or disengagement. In other words, to preserve 
computational resources the online monitor may not be engaged in flight condi- 
tions that are considered to be a priori safe. 

3 Novelty Detection Technique 

In general, novelty detection techniques require beforehand knowledge of both 
nominal and off-nominal flight domains. However, for the validation of NN in 
online adaptive systems, it is impossible to anticipate all possible adverse en- 
vironmental conditions and/or failure modes. Under flight failure scenarios, the 
performance of most regular classification models deteriorate due to restrictions 
in their generalization capabilities and low quality data. As a one-class clas- 
sification tool, Support Vector Data Description (SVDD) technique is derived 
from Support Vector learning theory by Tax et. al. [10, 11]. Differing from gen- 
eral support vector classifiers that decide the maximum margin hyperplane to 
separate two classes, SVDD method tries to find an optimal decision boundary 
for a given data set. Thus, it provides the best possible representation of the 
target-class and offers inferences that can be used to detect the outliers from the 
nominal feature space. This, for our validation purposes, can be defined as the 
“safe region ", relating to nominal flight conditions. 

SVDD is developed from the concept of finding a sphere with the minimal 
volume to contain all data [12-14]. Given a data set S consisting of N examples 
x iy i = 1 , ..,7V", the SVDD’s task is to minimize an error function containing the 
volume of. this sphere. With the constraint that all data points must be within the 
sphere, which is defined by its radius R and its center a, the objective function 
can be translated into the following form by applying Lagrangian multipliers, 

L{R , a, ai) = R 2 - ^2 a i{R 2 ~ i x * ~ 2 ax i + a 2 )} 

i 

where a* > 0 is the Lagrange multiplier. L is to be minimized with respect to 
R and a and maximized with respect to o,. By solving the partial derivatives of 
L, we also have: 

t 

and 

a — &iXi , 

i 

which gives the Lagrangian with respect to a*: 

L = y~' y «i(x i • Xi) - aiOij(xi ■ Xj) 

* ij 


where a* > 0 and a* = 1. 
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Fig. 2. SVDD with different distances from the center. 



In the solution that maximizes L } a large portion of a*’s become zero. The 
rest of ai’s are greater than zero and their corresponding objects are those called 
support objects. They lie on the boundary that forms a sphere that contains the 
data. Hence, object z is accepted by the description when: 

i v - a ii 2 = (2 - X a<x >)( z - X aiXi ) - r2 ■ 

i i 

Real world systems usually produce multi-dimensional highly nonlinear data 
that are inseparable by a linear discriminant. This makes the data description 
harder to obtain. Similar to the Support Vector Machine (SVM) [10], by replacing 
some kernel function K{x > y) with the product of (x,y) in the above equations, 
we are able to map our data from a high dimensional space onto a Hilbert space, 
which is also referred to as the “feature space”. In the feature space, objects can 
be classified with lower complexity. Selecting the well-known Gaussian kernel 
function, where K(x,y) ~ exp(—\\x — y|| 2 /s 2 ), we now have: 

£ = 1 - X Q i -X^i^i' 1 ))' 

i i^j 

The formula of checking object z now becomes: 

1 - 2 ^2 a iK(z,Xi) + '^a i O£ j K(xi } Xj) < R 2 . 

i ij 

Since the SVDD is used as a one-class classifier, in practice, there are no 
actual outliers well defined other than those randomly drawn from the rest of 
the space outside the target class. However, by applying the SVDD method, 
we can obtain a relatively sound representation of the target class. To detect 
outliers, a more precise criteria should be inferred from empirical testing or 
pre-defined thresholds. By setting the boundaries to a certain distance from 



the center, Figure 2 illustrates the different boundaries with respect to different 
parameter settings. A rule of thumb here is that the greater the value of the 
distance from the center, the rougher the boundary. Therefore, the number of 
the outliers that can be detected decreases. In practice, a pre-defined threshold 
can be used as the furthest distance of a data point from the center, which the 
system can tolerate. Such pre-defined thresholds need sufficient testing within 
each specific data domain. 

4 Online Monitoring 

Self-organizing neural networks, introduced by Kohonen [15] and modified by 
several others [17-19] over the last twenty years, offer topology-preserving adap- 
tive learning capabilities that can, in theory, respond and learn to abstract from 
a much wider variety of complex data-manifolds, the type of data encountered 
in an adaptive flight control system. 

The adaption of neural networks can successfully model the topology and 
abstract the information from data patterns that have a predictable structure. 
However, during online adaptation, the data patterns may be presented to the 
network at a varying sampling rates. The presented data can exhibit pathological 
dimensional stratification, such as uniformity or functional discontinuities. It 
has been observed (experimentally) that under these circumstances, the neural 
network encounters difficulties in learning and abstracting information from the 
presented data, eventually leading to a deteriorating network performance. In 
such cases the neural network might fail in its primary goal “to successfully learn 
and provide a better estimate of the learnt parameters to the flight controller”. 
This degradation in the network’s performance is depicted in a loss of its self- 
stabilizing properties. The goal of an online stability monitor is to capture and 
analyze the self-stabilizing properties of the network in the hope that it will be 
able to detect unstable neural network behavior and warn the pilot/system of 
the imminent threat to the controller. 

The construction of an online stability monitor is based on rigorous mathe- 
matical stability analysis methodology, Lyapunov's direct method [16]. According 
to this method, a system is said to be stable near a given solution one can con- 
struct a Lyapunov function (scalar function) that identifies the regions of the 
state space over which such functions decrease along some smooth trajectories 
near the solution. In the discrete sense, Lyapunov stability can be defined as 
follows: 

Definition L Lyapunov Stability 

If there exists a Lyapunov function , V : M° —* R, defined in a region of state 

spittCC Ticuj (i SOtUotO i y uj u SUCh that 

1 . V(0) = 0 

2. V (x) > 0 : Vx €O,r^0 

3 . V(x(ti+i)) - V{x(ti)) = AV{x) < 0 ; Vx <E O 

then the solution of the system is said to stable in the sense of Lyapunov. 



x = 0 represents a solution of the dynamical systems and M°, O represent the 
output space and a region surrounding this solution of the system respectively. 

According to the above definition a system is stable if all solutions of the 
state that start nearby end up nearby. A good distance measure of nearby must 
be defined by a Lyapunov function (V*) over the states of the system. By con- 
structing V, we can guarantee that all trajectories of the system converge to a 
stable state. The function V should be constructed keeping in mind that it needs 
be scalar (V 6 R) and should be non-increasing over the trajectories of the state 
space. This is required in order to ensure that all limit points of any trajectory 
are stationary. 

Definition 2. Asymptotic Stability (AS) 

If in addition to conditions 1 and 2 of Definition 1 } the system has a negative- 
definite Lyapunov function 


AV{x) < 0 : Vx € O (1) 

then the system is Asymptotically Stable. 

Asymptotic stability adds the property that in a region surrounding a solution 
of the dynamical system trajectories are approaching this given solution asymp- 
totically. 

Definition 3. Global Asymptotic Stability (GAS) 

If in addition to conditions 1 and 2 of Definition 1 : the Lyapunov function is 
constructed such that , 


limV(:r) = 0 (2) 

t — *oo 

over the entire state space then the system is said to be Globally Asymptotically 
Stable . 

A notable difference between AS and GAS is the fact that GAS implies any 
trajectory beginning at any initial point will converge asymptotically to the 
given solution, as opposed to AS where only those trajectories beginning in the 
neighborhood of the solution approach the solution asymptotically. The types of 
stability defined above have increasing property strength. 

Global Asymptotic Stability Asymptotic Stability => Lyapunov Stability. 

The reverse implication does not necessarily hold as indicated by the Venn 
diagram of Figure 3. Thus a strict Lyapunov function should force every tra- 
jectory to asymptotically approach an equilibrium state. Even for non- strict 
Lyapunov functions, it is possible to guarantee convergence by LaSalle’s invari- 
ance principle. In mechanical systems a Lyapunov function is considered as an 
energy minimization term. In economic and finance evaluations it is considered 



Fig. 3. Relative strengths of Stability 


as a cost-minimization term, and for computational purposes it can be consid- 
ered as an error-minimization term. Figure 4 shows a Lyapunov function for 
the NN operation where the decreasing cylinder radii indicate a converging, sta- 
ble operation. The online stability monitor essentially computes Lyapunov and 
Lyapunov-like functions (similar to the one shown in Figure 4) based on the cur- 
rent states of the neural network learner and analyze each function to evaluate 
the overall network stability. Thus, online stability monitoring complements an- 
alytical stability analysis techniques by being being able to detect system states 
that deviate away from stable equilibria in real-time. 



Fig. 4. A converging Lyapunov-like function. 



5 Case Study 


The knowledge gained through the design and evaluation of new control schemes 
is of direct use in performance verification and validation. Proper experimenta- 
tion is required to justify realism and applicability of the proposed techniques 
into actual practice. 

5.1 The Intelligent Flight Control System 

The Intelligent Flight Control System (IFCS) was primarily developed by NASA 
as a novel flight control system with the primary goal to “flight evaluate con- 
trol concepts that incorporate emerging soft computing algorithms (NN or AI 
techniques) to provide an extremely robust aircraft capable of handling multiple 
accident and/or an off-nominal flight scenario ” [1,2,7]. 



c ontrol 
c om m and * 



E puVi~^ fc^ rp)l7r) • 


Fig. 5. The Intelligent Flight Control System. 

The diagram of Figure 5 shows the architecture of the IFCS using Dynamic 
Cell Structure (DCS) neural network, referred to as the Online Learning Neu- 
ral Network (OLNN). The control concept can be briefly described as follows. 
Notable discrepancies from the outputs of the the Baseline (Pre-trained) Neural 
Network (PTNN) and the Real-time Parameter Identification (PID), either due 
to a change in the aircraft dynamics (loss of control surface, aileron, stabilator) 
or due to sensor noise/ failure, are accounted by the Online Learning Neural Net- 
work. The primary goal of OLNN is to learn online and provide a better estimate 
for future use of these discrepancies, commonly known as Stability and Control 
Derivative errors. The critical role played by the online learning neural network 
in fine-tuning the control parameters and providing a smooth control adjust- 
ments is the motivation for the need for a practical, nonconventional validation 
methodology. 

Major advances in the development of modern control laws have generated 
the need for developing very detailed and sophisticated simulation environments 
for R&D purposes. Novel techniques for adaptive flight control achieves maturity 





through extensive experimentation in simulated environments. Figure 6 shows 
the interface of the IFCS F-15 simulator developed by the WVU research team. 
The control framework of the simulator is based on the IFCS architecture, shown 
in Figure 5. Through the high fidelity simulator, we are able to collect valuable 
data representing nominal flight conditions as well as some failure scenarios. 



Fig. 6. NASA-WVU F-15 Simulator 


5.2 Flight-Data Description 

The simulation data depicts nominal and off-nominal flight conditions of ap- 
proximately 10 seconds of flying time corresponding to 200 frames of data at the 
simulation rate of 20Hz. A data frame is a point in a seven- dimensional space 
corresponding to 4 sensor readings (independent variables) and 3 stability and 
control derivative errors from PID and PTNN (dependant variables). The NN 
tested here is the DCS - C z network, one of the five DCS-subnetworks of the 
IFCS. The independent variables are Mach number (the ratio of the speed of 
the aircraft to the local speed of sound), alpha (aircraft’s angle of attack) and 
altitude of the aircraft. The dependent variable are three stability and control 
derivative errors generated by the difference between PID and PTNN. 

In the following sections, we first present novelty detection results using 
SVDD on the NN training data. Online stability monitoring results for NN 
learning are described next. Both tools are tested on two failure mode data sets 
obtained from the simulator. The two specific types of failures induced in the 
IFCS simulator are control surface failures (stuck aileron, stabilator) and loss 
of control surface. A control surface failure (locked left stabilator, stuck at -h3 
Degree) is simulated into the system at the 100 th data frame. In another simu- 
lation, a loss of control surface (50% missing surface of right aileron) failure is 
also induced at the 100 th data frame. 



| H 


5.3 Novelty Detection Using SVDD 

We first simulate one run of nominal flight conditions of 40 seconds with a seg- 
ment of 800 data points saved. After running SVDD on the nominal data, we 
obtain a sound data description of nominal flight conditions. The data descrip- 
tion is then used to detect novel data that falls outside the boundary. The crosses 
in Figure 7(a) and Figure 8(a) represent the nominal data points on which the 
boundary is found by SVDD. 
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Fig. 7. Novelty detection results using SVDD on control surface failure simulation data, 
(a): SVDD of nominal flight simulation data is used to detect novelties, .(b): Novelty 
measures returned by SVDD tool for each testing data point. 




Fig. 8. Novelty detection results using SVDD on loss of control surface failure simula- 
tion data, (a): SVDD of nominal flight simulation data is used to detect novelties, (b): 
Novelty measures returned by SVDD tool for each testing data point. 


We then use the boundary formed by SVDD to test on failure mode simu- 
lation data. Novelty detection results for control surface failure simulation data 




and loss of control surface failure simulation data are shown in Figure 7 and Fig- 
ure 8 respectively. Circles in Figure 7(a) and Figure 8(a) represent failure mode 
simulation data. In the plot of Figure 8(a), depicting the loss of control surface 
failure, a large portion of failure mode data falls outside the boundary. The loss 
of control surface failure indicates a more substantial damage than the stuck-at 
type of failure. Consequently, the data points in Figure 8(a) fall further outside 
the nominal data boundary than the data points in Figure 7(a). The novelty 
measures shown in Figure 7(b) and Figure 8(b) are probability-like measures 
computed for each data point based on the distance from the SVDD boundary 
formed on the nominal flight condition data. Correspondingly, in plots of Figure 
7(b) and Figure 8(b), we can see that the novelty measures of loss of control sur- 
face failure data after 100 th data frame are larger than those of control surface 
failure data. In both figures, after the 100 th point, when failures occurred, SVDD 
detects the abnormal changes and returns with the highest novelty measures. 
This demonstrates the reasonably effective and accurate detection capabilities 
of our SVDD detector. 

5.4 Online Stability Monitoring 

Described novelty detection mechanisms provide an independent approach to re- 
liable failure detection, thus enhancing the ability of the system analyst, to eval- 
uate the mechanisms in charge of the activation adaptive component (s). Online 
stability monitors serve the purpose of evaluating whether adaptive subsystem 
provide adequate accommodation capabilities that address specific environmen- 
tal conditions. In other words, the monitors track the adaptation process and 
continually evaluate the difference between the current state abstraction pro- 
vided by the learning device (DCS neural network in our case study) and its 
desired goal. 

Adaptive systems axe associated with uncertainty, many degrees of freedom 
and high noise-level in real flight conditions. Due to their complexity, we may 
not always be able to check to see if each dimension of the input data is ef- 
fectively abstracted and represented by the neural network. Lyapunov theory 
provides the tool to collapse the multidimensional evaluation criteria into one or 
a few meaningful bounded functions. The data sets being modeled in the case 
study represent short data sequences for one out of five neural networks in the 
intelligent flight control system. We constructed four Lyapunov-like functions 
to reduce the need for checking effective learning by each dimension. Rather 
than looking onto several dozen graphs, the adequacy (stability) of learning can 
be assessed from the analysis of these four graphs, representing the Lyapunov 
functions. 

The four Lyapunov-like functions are specific for the DCS neural network 
of the Intelligent Flight Control System. Their formal description would require 
detailed presentation of the DCS learning algorithm, which is outside of the scope 
of this paper. In general terms, the DCS network is a so called self-organizing 
map. Self-organizing maps evolve their topology to reflect as closely as possible 
the topological characteristics of the data set being approximated. Therefore, by 



measuring euclidian distances within the evolving network and comparing them 
with actual distances in the training data set, we may derive the measure of 
the goodness of approximation. The four Lyapunov like functions were defined 
because they evaluate different aspects of DCS adaptation: the Kohonen’s rule 
and the competitive Hebbian rule [19,20]. Furthermore, we noticed that these 
four functions react with different intensities to different training data sets. Given 
that these data sets represent actual aircraft failure scenarios, selected Lyapunov- 
like functions complement each other. 

As the neural network starts to adapt to the presented failure mode data, the 
run-time monitor is engaged. It continually monitors the behavior of the neural 
network. Figure 9 shows the plots of the four Lyapunov-like monitors before a 
control surface failure (locked left stabilator, stuck at -f3 Degree) is induced into 
the system, and before it propagates into the neural network. Figure 9 shows 
no predominant spikes in the individual monitors, indicating the lack of intense 
adaptation in nominal conditions. Because the neural network does not attempt 
to change the control input to the flight control system, its output bears very 
limited overall system risk during this period. 
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Fig. 9. Online Monitors: Pre-control Surface Failure 


Figure 10 shows the plots of the four Lyapunov-like monitors after the control 
surface failure (locked left stabilator, stuck at +3 Degree) is induced into the 
system and after the failure propagates into the neural network. Figure 11 shows 
the plots of the four Lyapunov- like monitors after the loss of control surface (50% 
missing surface of right aileron) is simulated into the system and after the failure 



propagates into the neural network. The plots show a predominant spike at time 
frame 100 (the time of the failure). The spikes indicate the successful detection 
of the unusual (failed) environmental condition by monitoring the internals of 
the neural network. In the short term, the neural network undergoes a significant 
degree of adaptation. The high values of the Lyapunov-like functions indicate 
that the neural network needs additional time (and learning cycles) to faithfully 
represent its newly arrived (in real-time) input data set. During this period, the 
confidence on neural network’s output diminishes drastically, i.e., the network is 
not providing the desirable failure accommodation. But, Within the next 50 or 
so frames in Figure 10, the values of Lyapunov-like monitors approach 0, indi- 
cating that the failure has been accommodated through adaptation. The failure 
accommodation delay is longer in Figure 11, an expected indication of the se- 
vere failure condition (the loss of a control surface). At this point, a verification 
and validation engineer needs to assess the adequacy of the failure accommoda- 
tion me chanis m with respect to the overall system safety requirements, evaluate 
alternative designs, and prepare suitable V&V recommendations to the safety 
board. 
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Fig. 10. Online Monitors: Post-control Surface Failure 
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Fig. 11. Online Monitors: Post-Loss of Control Surface Failure 


6 Conclusions 

We developed a non-conventional approach for validating the performance ad- 
equacy of the neural network embedded in an online adaptive flight control 
system. The validation framework consists of 

— Online filters (novelty detectors) that check the validity of inputs and control 
outputs j and 

— Runtime stability monitors that examine the stability properties of the neu- 
ral network adaptation. 

Experimental results from the data collected on an F- 15 aircraft flight simulator 
show that: 

1. SVDD can be adopted for defining nominal performance regions for the 
given application domain. Our techniques provided successfully automated 
separation between faulty behaviors and normal system events in real-time 
operation. 

2. Based on the originally developed concept of Lyapunov-like functions applied 
for the first time to neural network learning, the online stability monitors 
have shown a successful realization of convergence tracking of adaptation 
error towards a stable (or unstable) and safe (or unsafe) state in the adaptive 
flight control system. 

We conclude that the proposed methodology provides a good approach for 
validating ' online adaptive system’s safety, stability and performance. The ob- 
served efficiency and scalability of both methods give us the expectation that 


the proposed V&V method can be successfully applied to other types of online 
adaptive learners. 
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